Skip to main content

DuoKey on Azure PaaS

The application tier runs on a private AKS cluster, data and secrets on managed Azure services behind private endpoints, and the root of trust stays outside Microsoft's control. Nothing is reachable from the internet except Application Gateway WAF.

Reference landscape

DuoKey on Azure PaaS, every component

DuoKey on Azure PaaSClients reach Application Gateway WAF and a load balancer; the Cockpit runs on a private AKS cluster with PostgreSQL Flexible Server, Key Vault and immutable backups on private endpoints; keys stay with MPC nodes in separate trust domains.MICROSOFT AZURE · YOUR SUBSCRIPTION · ONE REGION, 3 ZONESHUB VNETAKS PRIVATE CLUSTER · 3 ZONESPRIVATE ENDPOINTS · PUBLIC ACCESS OFFKEY CUSTODYUsers, Microsoft 365DKE, KMS and API clientsKMIP clientsStorage arrays, databasesYour operatorsSSO and MFADuoKey releasesImages by digestYour Git repositoryHelm values, TerraformEntra IDSSO, MFA, PIMAzure MonitorPrometheus and logsSentinelSIEM, audit logsApp GatewayWAF v2, HTTPSLoad BalancerKMIP TCP 5696Azure FirewallEgress allow-listExpressRouteor VPN gatewayRegistry (ACR)Premium, private›kCockpit frontendSingle-page app›kCockpit APIDKE, KMS, KMIP, PKIArgo CDGitOps, one appExternal SecretsWorkload IdentityManaged RedisOptional shared cachePostgreSQL FlexibleZone-redundant HABlob + Azure BackupImmutable backupsKey Vault PremiumSecrets, or OpenBao›kMPC node AAKS confidential pool›kMPC node BYour data centre›kMPC node CThird trust domainSecurosys HSMOptional hardware rootThe Software Vault is built in.MPC and HSM are optional backends.11223456789HOW TO READ THIS FIGUREDuoKey componentCloud or partner serviceOptional1Clients reach Application Gateway WAF, the only public entry2HTTPS goes to the frontend and API, KMIP TCP to the API3The API uses PostgreSQL over a private endpoint4The API reaches its key custody backend over mutual TLS5External Secrets reads Key Vault with workload identity6Argo CD applies the Helm values from your Git repository7DuoKey images are imported by digest into your Container Registry8Operators come in over ExpressRoute or VPN, with SSO and MFA9MPC nodes in separate trust domains use mutual TLS

Public network access is disabled on PostgreSQL, Redis, Key Vault, Container Registry and Storage. Customer-managed keys encrypt PostgreSQL, Storage and the AKS disks; customer root keys stay with the Software Vault, the MPC nodes or the HSM.

Choices to make​

  • Platform secrets. Key Vault Premium with Workload Identity and External Secrets has fewer moving parts. OpenBao on AKS with Raft is identical to the on-premise deployment and portable off Azure.
  • Key custody per customer segment. The DuoKey MPC KMS with one node on an AKS confidential node pool, one in your data centre and one in a third trust domain, a Securosys HSM reached over ExpressRoute or VPN, or both.
  • Region. One region with three availability zones, and a second region for disaster recovery if required.
  • Operator identity. Microsoft Entra ID for SSO, MFA and Privileged Identity Management, mapped to DuoKey roles.

Check that Managed Redis and confidential node pools are available in your target region before sizing.